Have full access to all apps in jenkins

[isichei]

When accessing Jenkins I can view and build all apps inside MoJ Analytical Services. This also means that I can grant access to apps I cannot see on github.

Tested example: the git repo court-travel-time-tool can only be accessed by 2 people. A 3rd person who cannot access the github repo can go into the jenkins grant-access-to-app and build with parameters adding themselves. They now have access to view the deployed app.

[RobinL]

Thanks Karik. Clearly something wrong here.

Can Ross K deploy the app too? Or can he just see it exists?

[andyhd]

Hi, can you please write up bug reports using the template provided?

We're currently working on replacing Jenkins for granting access to apps and creating users, etc. I don't think we will fix the Jenkins job in the meantime unless it is very urgent.

[andyhd]

@jmoz @axemonkey is this helped by your recent work?

[RobinL]

@jmoz sounds like this is a feature we need to add to the backend:

(1) When granting access to Shiny app users (cusomters), our users (developers) should only be able to grant access if they are an admin of the app (2) We need to think about this in the context of our new CI solution. Ideally you should only be able to deploy an app if you're the admin of that app (or similar solution). We probably need to think about this second point in more detail.

[jmoz]

@RobinL ok so 1) we need a ticket for permissions on the new endpoint

[andyhd]

Is this fixed now @axemonkey @RobinL ?

[andyhd]

Jenkins is gone and granting access to apps is restricted to app admins in the Control Panel.